EXTERNAL VERSION 


İCO. 


Information Commissioner’s Office 


Operation LINDEN 
Unsolicited Marketing Communications Strategy Meeting 


Which? 2 Marylebone Road, London, NW1 4DF 
13 February 2019, 9am-11:30am 


Attending: 


Chair: ICO: Andy Curry, Enforcement Group Manager 


e ICO: Kerry Smith, Enforcement 
e ICO: Rob Cole, Enforcement 
e ICO: Stephanie Braley, Intelligence 


CMRU: Greg Williams, MOJ Claims Management Regulation Unit 
DMA: Arthur Cummings, Data and Marketing Association 

DMA: Mike Lordan, Data and Marketing Association 

DMC: George Kidd, Direct Marketing Commission 

FCA: Barbara Kubis-Labiak, Financial Conduct Authority 

FR: Sarah Fox, Fundraising Regulator 

FR: Priya Warner, Fundraising Regulator 

GC: Siobhan Woolmer, Gambling Commission 

IFB: Claire Haines, Insurance Fraud Bureau 

IS: Alan Tonge, Insolvency Service 

IS: Iain MacGregor 

MRS: Michelle Goddard, Market Research Society 

NTSIT: Emily Rae Whitehall, National Trading Standards Intelligence Team 
Ofcom: Gavin Daykin 

SRA: Christopher Hall, Solicitors Regulation Authority 

TPR: Paul Sweeney, The Pensions Regulator 

Which?: Adam Gillet 


Apologies: 


e DMA: Stephen Sullivan, Data and Marketing Association 
e NTSST: Richard Clarke, National Trading Standards Scams Team 
e PSA: John Hodge, Phone-paid Services Authority 


Aim of LINDEN 


To capture and share intelligence effectively and identify, plan, deliver and promote 
coordinated activity to maximise enforcement opportunities against individuals and 
organisations responsible for breaching legislation associated with unsolicited marketing 
texts, live and automated calls and silent or abandoned calls. To protect the privacy and 
consumer rights of individuals and to improve compliance. 
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Agenda: 


Introductions - For those who have not previously attended (All) 


ICO updates - Including a wrap up of reporting; focusing on a six monthly 
update, recovery actions and what we have planned 


Activity and actions updates - 5 minute update on relevant activity from each 
organisation, as well as proposed actions for the next quarter. (All) 


Week of Action - proposals for future proactive work 

CPP Brexit Intel WG & E-Privacy update 

Financial Recovery Unit and directors’ liability 
Operation HIDA update 

International enforcement — UCENet Strategic Plan update 


AOB (Inc. intelligence requirements and next meeting / host) 


ICO updates 


Enforcement 


Excluding potential cases under a larger ICO operation, there are three notices of 
Intent for £240,000 currently in progress. A further three cases being drafted. 


So far in financial year 18/19 there have been 18 monetary penalties issued. 
During the previous financial year 26 were issued in total. 


12 out of 18 of the current monetary penalties were against live calls. 

Overall performance remains similar to last year. 

Move towards more thematic rather than volume based analysis with key areas 
being those with potentially high detriment such as pensions, payday loans and life 


insurance - must have a marketing element rather than just being fraudulent in 
nature. The latter are referred to action fraud as appropriate. 
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Intelligence 


FY 2017/18: 


Concerns reported by type: August 18 - January 19 (last six months) 


Live - 35,165 
Auto - 31,598 
SMS - 7,019 


Total - 73,782 


Despite the dip over the Christmas period, the total number of concerns being submitted 
to the ICO is increasing. As with our last update the majority of concerns reported are still 
falling within the automated call category though the gap between them and live calls is 
becoming increasingly smaller. 


Compared to the previous six month period the volume of complaints have increased by 
37%. Compared to the same six months last year, volumes have also increased, this time 
by 46%. This rise is in line with the general year on year increase we are seeing, which 
becomes more established as they year progresses. 


Complaints have tailed off slightly since the spike following the introduction of GDPR 
(+45%), though there was an increase after the cold call ban on CMCs introduced in 
September (+63%). It’s possible we will see a similar rise in the pension’s category post 
January, however, previously we have seen this issue ‘piggy back’ on other complaint 
types such as investment and banking calls so pension complaints as a category may not 
increase substantially. It should also be noted that with pension scams, the true 
fraudulent / nuisance nature of the call may not be discovered until much later at which 
point the individual likely has more pressing concerns than reporting the original call to 
the ICO. Pension are currently a key area of interest for the ICO’s PDMIT team given the 
potential for harm and work is ongoing. 


Also considering how social media and messaging apps could be used as new channels for 
nuisance messaging and how this could be reported and tracked going forward. 


In terms of TPS data, this has remained fairly steady during 2018, especially when 
compared to ICO data trends following changes to legislation. Interestingly whilst the ICO 
has seen an upward trend overall, the reverse is true for the TPS data. This difference 
could be caused by changes in reporting behaviours, increased public awareness of the 
ICO or an increase in automated complaints, which fall outside the TPS remit. 


Page 3 of 10 


EXTERNAL VERSION 


1CO. 


Information Commissioner’s Office 


Current trends: 


SRA 


Shift towards callers using multiple CLIs in low volumes in order to avoid detection. 
New approach to be thematic rather than solely volume based to tackle this. 


Accident Claims: remains highest reported category by far and in January 
accounted for 30% of all complaints received. The majority of calls are automated 
(75%) and initial analysis indicates they are likely related to an ongoing ICO 
operation. 


Broadband: this category is consistently high and is predominantly made up of 
automated ISP scams. We have seen a sharp year on year increase in this category 
with concerns up 352%. Working with NFIB / Action Fraud. 


Debt management: rising topic - November saw the highest reported concerns in 
this topic since June 14. Though there was an expected decline over the Christmas 
period, complaint volumes are still much higher than usual. January was up 426% 
since the previous year. Complaints usually relate to automated calls from an 
unknown sender. 


Pensions: volumes remain relatively static so far, though we could see an increase 
in the coming months following a rise in public awareness of the ban. 


SMS: seeing a rise in payday loans which became the highest reported topic in 
January (+177%). Gambling concerns remain one of the highest reported SMS 
topics though complaints show a downward trend overall. 


Activity & Action updates (ALL) 


Current themes of interest - PI and RTA still constant and significant area of work. 
Continue to work with partners (IFB / FCA / CMRU). 

Cold calling not necessarily by solicitors but by their introducers. 

Engaging with other regulators re: Pension scams. The difficulty is that these scams 
don’t always present themselves as such right away. 

Work on concerns relating to housing disrepair. Trying to identify solicitors 
involved. 


Insurance Fraud Bureau (IFB) 


Holding an Intelligence forum on the 14 February on enabling activity - claims 
farming, data theft and data vishing. This forum is for members in the industry and 
the ICO and OFCOM have agreed to present. 
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Recently held a workshop relating to Google ad spoofing after RTCs where 
individuals are being directed to a marketing company not the insurer. This is due 
to the marketing company’s website being placed at the top of the list of search 
results. Generic names are used to answer the phone leading to customers being 
encouraged to take out expensive credit hire where they may be challenged by the 
at fault insurer. They are careful not to mention the Insurers name so they cannot 
be accused of impersonation. In contact with regulators including the FCA, SRA, 
CAB and action fraud. Also encouraging customers to submit SARs to the 
companies involved to identify fraudsters. Cease and desist letters to companies 
suspected of impersonation. 


Regularly receive referrals from our customers in relations to claims farming, data 
vishing and acting without instructions. We issue reports to the industry to share 
this intelligence and develop potential investigations to be passed to law 
enforcement and regulators. 


Market Research Society (MRS) 


Code of conduct consultation - any comments please send views. 


The 2019 draft edition of the MRS Code of Conduct 


Revisions have been made to the existing MRS Code of Conduct to reflect 
evolving ethical best practice and significant changes in the data protection 
framework. The changes also seek to ensure that the Code keeps pace with 
the accelerated speed and progress of technological development and data 
use. It is important that practitioners can easily understand, access and 
use the MRS Code of Conduct and that it is also easily accessible to 
members of the public. 


https://www.mrs.org.uk/pdf/Draft%20MRS%20Code%200f%20Conduct%202019 
%20-converted. pdf 


CMRU 


Conducted audits of 15 authorised claims management companies engaged in 
direct marketing and / or data, and issued comprehensive advice where breaches 
were identified. 

Issued warnings to 4 authorised claims management companies for direct 
marketing breaches, mostly in relation to insufficient due diligence when accepting 
data from third parties and unfair processing of data for marketing purposes. 
Progressed formal investigations into 12 authorised claims management businesses 
engaged in non-compliant direct marketing. 

Continued to work closely with the ICO, Ofcom and the Advertising Standards 
Authority to assist with investigations. 

Current trends - payday loans up and PPI moving towards postal marketing 
Preparing information and cases ready for transition to FCA on 1 April 2019. 
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FCA 


e CMCs registering for temporary permissions — need to register by end of March. 

e Taking firms through authorisation process. 

e Scottish CMCs not regulated before are being dealt with in the first application slot, 
with PI to follow after that. 

e Working on new and existing MOUs. 

e Working on CMRU transition and data migration. 


DMA 
TPS data 


e Continue to see reduction year on year, even when accounting for seasonality. 
Possible main reason may be that automated calls, which are often the cause of 
current increases in volume, are not within TPS remit. 

e There have been fewer cases reported where the caller is identifiable. 

e Many spoof calls relating to AC companies and numbers. 

e Still seeing complaints relating to ‘TPS’ or similar services - these have been 
referred on to action fraud. 

e Continue to work with ICO and support cases and call action logs. 

e Continue to clean the TPS register, 5 million defunct records removed. 


Insolvency Service (IS) 


e 4-5,000 complaints overall which whittle down to 500 per year relating to short 
term fraud to high end investment scams. Some cases have led to director 
disqualifications. 

e Seeing a switch in concerns from PPI to life insurance. 

e In recent months have seen an increasing number of company hijack cases relating 
to timeshares investments / land property or alternatively the setting up a 
company with deceased directors or those that are unaware of their involvement. 


Which? 


e Initial campaign focusing on Director level accountability - to work with ICO. 

e Move to focus on scams and consumer issues more generally. 

e Working to re-vamp online report tool for nuisance calls to become more user 
friendly and accurate - to work with ICO to better understand category content. 

e Side publishing issues with HMRC recordings and the surge in BT complaints for 
awareness. 

e TPS mobile clone - might promote again. 

e Invited guests to come and talk about work - contact Adam if interested. 
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DMC 


Complaints in the 100 not 1000s. 

People who join take data protection and direct marketing issues seriously. 
ASA/Committee on Advertising Practice code amendments published addressing 
data issues and legitimate interest as a basis for marketing - DMC invited to act as 
a new specialist advisory panel to ASA when dealing with any cases under these 
provisions. 

This move could allow DMC to contribute in cases that do not involve members of 
the DMA. 


Direct Marketing Commission’s latest Annual Report for 2018. 


https://www.dmcommission.com/news/2019/02/complaints-about-data-and-privacy- 
still-dominate-2018/ 


NTS - 


Intelligence Team 


Working with Trading Standards around green energy and solar panel maintenance 
and looking into cold calls advertising / offering fake jobs with an upfront training 
fee. 


Fundraising Regulator (FR) 


Reminded that new financial year for the FR is 1 of September. 

Year on year drop in concerns, though may be partially due to changes to their 
online form to remove non relevant cases or complaints suited to other regulators. 
January increase in complaints not as high as the previous year. 

80-100 investigations in the upcoming year likely 

Themes are not often relevant to this group as they tend to focus on face to face 
marketing - often unintentional or not properly explained. 

No rise in social media targeting so far but may start to see going forward. 

Able to categorise own data due to much smaller volumes so accuracy is good. 
FPS has slowed down since initial launch (possibly due to GDPR). Concerns mainly 
relate to those who failed to action suppressions. 

Since July 2017 - working with the ICO to address Charities who received a 
notification but have not actioned. 

Planning to publish summaries of all investigations into complaints received from 
March 2019 onwards, which will name the organisations investigated. 


GK (DMC): Enquired if any concerns relating to fake charities / scams 
SF (FR): Not that have been complained about yet, though if it is clear the concern 


is not about a legitimate charity it would be referred to action fraud as it would fall 
outside the FR’s remit. 
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Gambling Commission (GC) 


MTA data from December showed a 61% year on year decrease in overall 
‘gambling’ complaints submitted to the ICO. In terms of SMS in particular, which 
makes up the majority of these concerns, this was a decrease of 73%. 

Potential cause of decline: introduction of licence condition with codes of practice. 


Generally seeing a reduction in cold calling and focusing more on serial scammers. 
Woking on increasing usable intelligence feedback from investigations. 

Continue to work with other regulators and the police. 

Engagement with industry working groups ongoing. 


Ofcom 


Continue to evaluate cases for enforcement through analysing Ofcom’s complaints 
data and nuisance calls reports provided by the industry working group. 

Engaging informally with number range holders whose numbers are the subject of 
misuse, to encourage those holders to take action to stop the misuse of their 
numbers. Can now withdraw numbers where holders do not take effective steps to 
stop the harm being caused by misuse of their numbers. 

The new General Condition that came into force 1 October 2018, will provide a 
regulatory mandate to ensure both call blocking solutions and number 
authentication functionality are deployed in communication provider (CP) networks 
- currently meeting with the major CPs to clarify what steps they have taken to 
comply with these new requirements. 


Launching a new SMS SenderID Protection Registry which will allow participants to 
register and protect the message headers they use in SMS communications thus 
preventing other parties from using it (scams). This initiative will start with banks 
and Government agencies but will be widened to all merchants and other public 
sector bodies during the year. 

Annual Joint Action Plan (Ofcom and ICO) on strategy of dealing with nuisance calls 
to be published in March 2019. 
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E-Privacy update (AC) 


PECR - SI amendments 


Various SI amendments proposed to cover CPC related provisions, as part of ‘No Deal’ or 
Withdrawal planning. Still no confirmation of e-Privacy Regulation progress, so still looking 
at autumn 2019 for more information and possibly May 2020 for introduction, though this 
is currently a best guess and is subject to change. The consultation for direct marketing 
is also now in draft. 


Financial Recovery Unit & Directors’ Liability update (KS) 


e Reviewing current internal processes; if a CMP is not paid moving to formal 
recovery action 


Working with other regulatory partners 
Director’s liability: can’t be applied retrospectively. 


Data Broking update (SB) 


The ICO currently has an active work stream on data brokers in relation to direct 
marketing. The audits of the six data brokers, which include the three main CRAs, are still 
ongoing. These, as publicly reported, are: Acxiom Ltd, Data Locator Group Ltd, Equifax, 
Experian, GB Group plc and, TransUnion (formerly Callcredit). While the ICO is not able to 
provide a detailed update at this time, it does intend to publish its findings in this area 
once this process is complete, which may also include additional guidance to industry as 
well as to the general public. The ICO is also currently considering its next steps once this 
particular phase of the data broker work stream is completed. Focus is on a way to keep 
our knowledge of this sector and its practices up to date and relevant. 


International Enforcement update (SB) 


UCENet 
Background 


Steve Eckersley (Director of Investigations) and Adam Stevens (Head of Intelligence) 
attended the Unsolicited Communications Enforcement Network w/c 8 October 2018 in 
New York. This was hosted alongside the Messaging Mobile and Malware Anti-Abuse 
Working Group, and organisation of the event was led by the ICO and US FTC (Sara 
DePaul from their International Affairs Department). 


The Executive Committee (US FTC, UK ICO, Canadian CRTC, Australian ACMA, Korean 


KISA and New Zealand DIA) agreed priorities for the network for the next three years, 
and will be developing a new strategic plan for the network based on the event. 
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Updated strategic plan 


An outline of this strategic plan for 2019 to 2021 has been produced setting out three 
priority areas: 


Priority 1: Intelligence and cooperation 

Priority 2: Communications and engagement 

Priority 3: Training and development 

We are currently seeking engagement and views from members (or prospective 


members) of UCENet on this plan. Therefore if you would like a copy of the outline and/or 
to provide any input please contact the ICO. 


Any Other Business (All) 


e N/A 

e Offers to host the next meeting in June/July requested. 

e Survey to be shared relating to the continued usefulness and future of Linden. 
e Goodbyes given to Sarah Fox (FR) as this was her last meeting. 

e Session closed thanking participants for attending. 
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